ICQ automatic update Remote Code Execution Vulnerability

Affected Versions:
ICQ, ICQ 7.2
ICQ 7 vulnerability description:
Bugtraq id: 45805

ICQ is a popular instant messaging chat tool.

ICQ has a security vulnerability during updates. Remote attackers can exploit this vulnerability to execute arbitrary code with user permissions.

ICQ 7 does not check the Update Server ID or the authenticity of the updates downloaded through its automatic update mechanism. By simulating an Update Server (such as DNS Spoofing), attackers can pretend to update the server or send arbitrary files at the next startup of the ICQ client. ICQ is vulnerable to attacks because it is automatically started by default when Windows is booted and updates are checked every time it is started. <* Reference
Daniel Seither
*>